Red Hat Security Advisory

RHSA-2007:0328

tomcat security update

Released 2007-05-24 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Developer Suite v.3 (AS v.4) jakarta-commons-modeler-2.0-3jpp_3rh, tomcat5-5.5.23-0jpp_6rh, tomcat5-common-lib-5.5.23-0jpp_6rh +4

Fixes 4 records

TI-2007-00437 CVE-2007-0450 · GHSA-4prh-gqw8-rgh5

Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and…

HIGH 66

Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote attackers to read arbitrary fil…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.91158 Published 2007-03-16 Fixed in 5.5.22, 6.0.10 CWE-22

TI-2005-01978 CVE-2005-2090 · GHSA-f2gq-p6qv-ccw4

Jakarta Tomcat 5.0.19 (Coyote/1.1) and Tomcat 4.1.24 (Coyote/1.0) allows remote attackers…

MEDIUM 42

Jakarta Tomcat 5.0.19 (Coyote/1.1) and Tomcat 4.1.24 (Coyote/1.0) allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Tran…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.26114 Published 2005-06-30 Fixed

TI-2007-01301 CVE-2007-1358 · GHSA-xmc9-6p56-3c4v

Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat…

LOW 32

Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Languag…

CVSS 2.0LOW 2.6 Network No auth Interaction — EPSS 0.19889 Published 2007-05-09 Fixed CWE-79

TI-2006-06936 CVE-2006-7195 · GHSA-p57v-p3fx-qgwm

Cross-site scripting (XSS) vulnerability in implicit-objects.jsp in Apache Tomcat 5.0.0…

LOW 28

Cross-site scripting (XSS) vulnerability in implicit-objects.jsp in Apache Tomcat 5.0.0 through 5.0.30 and 5.5.0 through 5.5.17 allows remote attackers to inject arbitrary web script or HTML via certain header values.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.05476 Published 2007-05-09 Fixed in 5.5.18 CWE-79